cognium-dev 3.114.0 → 3.116.0

package/dist/cli.js

@@ -11697,7 +11697,8 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sourceLines = code !== undefined ? code.split(`
 `) : undefined;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
@@ -11752,6 +11753,53 @@ function expandPromisifyAliases(patterns, sourceLines, language) {
   }
   return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
 }
+function expandIndirectEvalAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0)
+    return patterns;
+  if (language !== "javascript" && language !== "typescript")
+    return patterns;
+  const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
+  const innerToPattern = new Map;
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language))
+      continue;
+    if (p.class !== undefined)
+      continue;
+    if (p.method !== "eval" && p.method !== "Function")
+      continue;
+    if (!innerToPattern.has(p.method))
+      innerToPattern.set(p.method, p);
+  }
+  if (innerToPattern.size === 0)
+    return patterns;
+  const aliasPatterns = [];
+  const seenAliases = new Set;
+  for (const line of sourceLines) {
+    const m = INDIRECT_EVAL_RE.exec(line);
+    if (!m)
+      continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName)
+      continue;
+    if (seenAliases.has(aliasName))
+      continue;
+    const template = innerToPattern.get(innerName);
+    if (!template)
+      continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `indirect ${innerName} alias — cognium-dev #188`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split(`
 `);
@@ -33306,6 +33354,14 @@ class UnrestrictedFileUploadPass {
             this.emit(ctx, findings, file, call.location.line, language, "Files.copy(input, Path.of(dir, <original filename>))");
           }
         }
+        if (m === "write" && callHasUploadName(call)) {
+          const rec = call.receiver ?? "";
+          if (rec === "Files" || rec === "FilePath" || rec.endsWith(".Files"))
+            continue;
+          if (inSafeRange(call.location.line))
+            continue;
+          this.emit(ctx, findings, file, call.location.line, language, "Part.write(<dir> + <original filename>)");
+        }
       }
     }
     if (language === "javascript" || language === "typescript") {
@@ -36780,7 +36836,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.114.0";
+var version = "3.116.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.114.0",
+  "version": "3.116.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.114.0"
+    "circle-ir": "^3.116.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",